Splunk Enterprise Certified Architect — Question 58

Users are asking the Splunk administrator to thaw recently-frozen buckets very frequently. What could the Splunk administrator do to reduce the need to thaw buckets?

Answer options

• A. Change frozenTimePeriodInSecs to a larger value.
• B. Change coldToFrozenDir to a different location.
• C. Change maxHotSpanSecs to a larger value.
• D. Change maxTotalDataSizeMB to a smaller value.

Correct answer: A

Explanation

Increasing the frozenTimePeriodInSecs allows buckets to remain in a frozen state for a longer duration before they are frozen, thereby reducing the frequency of thawing requests. The other options do not directly address the frequency of thawing; changing coldToFrozenDir affects storage location, adjusting maxHotSpanSecs changes the time hot data stays hot, and altering maxTotalDataSizeMB impacts overall data capacity instead of thawing frequency.